Service
Network Infrastructure & Security
I help organise network infrastructure and limit unnecessary access to resources. I review how devices communicate, how access is configured and how suspicious events can be detected.
Issues worth investigating
- Devices serving different purposes can reach the same resources.
- Remote access and communication rules no longer reflect current needs.
- Wi-Fi or performance problems disrupt work, but the cause is unclear.
- Alerts lack the context needed to decide what to do next.
Network segmentation and resource access
I review which devices and services need to communicate. Within the agreed scope, I configure VLAN segmentation and VPN access to reduce unnecessary connections while preserving those required by applications.
I also review network and Wi-Fi configuration for performance issues. The scope depends on available equipment, permissions and information about the environment.
Detecting and interpreting events
I use solutions such as Snort to detect suspicious traffic and Wazuh to analyse events and the state of monitored systems. The choice depends on what information needs to be collected and who will act on it.
An alert alone does not confirm an incident. I review its context and dependencies to distinguish events requiring action from signals needing further investigation.
Agreeing the work and its outcomes
I start with the network layout, critical services and reported issues. I agree access and the impact of planned changes on day-to-day work.
Depending on the engagement, outcomes may include segmentation recommendations, a record of configuration changes or agreed arrangements for handling alerts. Implementation and ongoing maintenance need an agreed scope.
What changes depend on
Segmentation requires support from the equipment and correct device configuration. Event visibility depends on the data available and where it is collected. Disruption originating outside the network, including DDoS, may require action by a connectivity or hosting provider; deploying VLANs or an IDS alone does not provide that protection.
Questions and answers
Should a guest network have access to business servers?
That depends on its purpose. The starting point is to separate internet access from access to internal resources; any exceptions should have a specific justification.
Does enabling monitoring solve incident response?
No. It is also necessary to agree which events need attention, who reviews them and how issues are escalated. Deploying a tool does not automatically include round-the-clock monitoring.
Let us discuss your network
Describe how people work, known issues and key resources. Do not include passwords or full configuration exports in the initial enquiry.
Describe the network issue in the audit enquiry formRelated areas
Network controls are complemented by Administration & Hardening.
Understanding information used for impersonation draws on knowledge of Human Element & Information (OSINT).
Certificates document knowledge and training; they do not demonstrate a particular implementation or, on their own, establish the scope of services offered.
// DOCUMENTED KNOWLEDGE: Network Infrastructure & Security
Introduction to DDos attacks. Protection methods.
Mechanisms of Distributed Denial of Service (DDoS) attacks and practical methods for protecting network infrastructure against downtime.
Snort IDS Implementation
Deployment of a signature-based Intrusion Detection System. Deep packet inspection, custom rule creation, and real-time network threat monitoring.